CISA added CVE-2026-41709, a VMware ESX logging flaw scored just CVSS 2.7, to its Known Exploited Vulnerabilities catalog on October 28, 2026, after CrowdStrike tied it to zero-day use by the China-nexus group Warp Panda. The bug lets someone with admin rights on the hypervisor act without leaving a log entry, which undermines every audit trail, incident report and compliance control that depends on that host.
